Can't connect using cafile #64
Description
SUMMARY
I'm using a self signed Certificate.
If I don't specify cafile the error is:
ConnectionError([SSL: CERTIFICATE_VERIFY_FAILED] self signed certificate in certificate chain ...)
If I use cafile the error is:
fatal: msg: Elastic error: /usr/local/share/ca-certificate/ca.crt
(which is the PATH of the CA on my host)
The CA is already loaded in the host update-ca-certificates
How can I verify the CA? Or set verify_certs = False as a workaround?
ISSUE TYPE
- Bug Report
COMPONENT NAME
elastic_common.py
ANSIBLE VERSION
ansible [core 2.13.2]
config file = None
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/local/lib/python3.8/dist-packages/ansible
ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/local/bin/ansible
python version = 3.8.10 (default, Jun 22 2022, 20:18:18) [GCC 9.4.0]
jinja version = 3.1.2
libyaml = True
COLLECTION VERSION
community.elastic 0.0.1
community.general 5.3.0
OS / ENVIRONMENT
Ubuntu 20.04
STEPS TO REPRODUCE
- name: Create Role
community.elastic.elastic_role:
login_user: "{{ES_USERNAME}}"
login_password: "{{ES_PASSWORD}}"
auth_scheme: "https"
auth_method: "http_auth"
#cafile: "{{ lookup('file', '{{CACERT}}') }}"
cafile: "{{CACERT}}"
login_hosts:
- "{{ES_HOSTNAME}}"
name: test
cluster:
- all
indices:
- names: "test-*"
privileges:
- all
EXPECTED RESULTS
Should connect to ES.
If I use curl with same parameters it works, so it's a problem in the library.
ACTUAL RESULTS
task path: /ansible/roles/elastic-users/tasks/main.yml:1
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: root
<127.0.0.1> EXEC /bin/sh -c 'echo ~root && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523 `" && echo ansible-tmp-1658165047.6121874-3120-144718124182523="` echo /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523 `" ) && sleep 0'
Using module file /root/.ansible/collections/ansible_collections/community/elastic/plugins/modules/elastic_role.py
<127.0.0.1> PUT /root/.ansible/tmp/ansible-local-3115fz480h5w/tmpgtnylhpq TO /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523/AnsiballZ_elastic_role.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523/ /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523/AnsiballZ_elastic_role.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '/usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523/AnsiballZ_elastic_role.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1658165047.6121874-3120-144718124182523/ > /dev/null 2>&1 && sleep 0'
The full traceback is:
File "/tmp/ansible_community.elastic.elastic_role_payload_xtfc2w9s/ansible_community.elastic.elastic_role_payload.zip/ansible_collections/community/elastic/plugins/modules/elastic_role.py", line 247, in main
File "/tmp/ansible_community.elastic.elastic_role_payload_xtfc2w9s/ansible_community.elastic.elastic_role_payload.zip/ansible_collections/community/elastic/plugins/module_utils/elastic_common.py", line 70, in connect
auth = self.build_auth(self.module)
File "/tmp/ansible_community.elastic.elastic_role_payload_xtfc2w9s/ansible_community.elastic.elastic_role_payload.zip/ansible_collections/community/elastic/plugins/module_utils/elastic_common.py", line 63, in build_auth
context = create_default_context(module.params['cafile'])
File "/usr/lib/python3.8/ssl.py", line 732, in create_default_context
raise TypeError(purpose)
fatal: [localhost]: FAILED! => changed=false
invocation:
module_args:
applications: null
auth_method: http_auth
auth_scheme: https
cafile: /usr/local/share/ca-certificates/ca.crt
cluster:
- all
connection_options: []
global_v: null
indices:
- names: test-*
privileges:
- all
login_hosts:
- elastic.local
login_password: VALUE_SPECIFIED_IN_NO_LOG_PARAMETER
login_port: 9200
login_user: elastic
metadata: null
name: test
run_as: null
state: present
timeout: 30
msg: 'Elastic error: /usr/local/share/ca-certificates/ca.crt'
PLAY RECAP ********************************************************************************************************************************************************************************************************************
localhost : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0